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Fedora as a pentesting OS 


Why am I talking about Fedora ? 


@ Linux addict since 2007, started with Ubuntu Studio before moving to 
Debian 


@ Fedora user and advocate since 2017 


@ Open Source contributor (mainly for Mozilla et OWASP foundation) 
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Fedora's mission and foundatio 


Y 


FREEDOM : Providing FOSS 


FIRST : Fedora and Red Hat innovate 
new things and become first providing 
them 
FEATURES : Adds latest 
development 
FRIENDS : Strong and caring 
community 
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Fedora Is sponsored by Red Hat 


@Fedora has the advantages of an open source 
community driven Linux distribution, but also 


benefits of a company’s infrastructure like Red 
Hat. 


@Some Red Hat employees work on Fedora Project 
to provide more innovation and hardened security 


@Fedora can be used in a corporate environment 
and has the tools to interact with different kind off, 
saairastructure and tools used | in companies 
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Packages Managers are flexible 


@The package manager is DNF (Dandified YUM), 
that replaces YUM for a better management of 
dependencies 


@YUM, the former package manager, is still 
available 


@APT, the package manager for Debian-based 
distros, is also available on Fedora 
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Virtualization is great 
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Virtualization is great 


@ Gnome Boxes (GUI for KVM) is installed by default on 
Gnome3 and simplifies the virtual machines management 


@ Virt-Manager has more settings than Gnome Boxes if you 
need more customisation 


@ KVM can be used in command-line and is fully compatible 
with Linux O eT --name Fedora35 \ 


-description ‘Fedora 35 Workstation’ \ 

--ram 4896 \ 

--vcpus 2 \ 

--disk path=/var/1lib/libvirt/images/Fedora-Workstation-35/Fedora-Workstation-35-260180518.0.x86_ 


--graphics vnc, listen=127.0.0.1,port=5901 \ 
--cdrom /var/lib/libvirt/images/Fedora-Workstation-35/Fedora-Workstation-Live-x86-64-35-1.1.iso 
--noau toconsole 
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Virtualization is great 


@ Gnome Boxes (GUI for KVM) is installed by default on 
Gnome3 and simplifies the virtual machines management 


@ Virt-Manager has more settings than Gnome Boxes if you 
need more customisation 


@KVM can be used in command-line and is fully compatible 
with Linux OSes 


@ Fedora has a Base Group called Virtualization, all useful 
tools for virtual machines are installable in one command 
line: A) 

ese dnf install @virtualization 
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At Ann Faillez 


podman pull hello-world 
podman run hello-world 


podman rmi <image id> 
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podman run -p 8080:8080 <image-name> 
podman ps -a 


podman stop <container id> 


podman run \ 

--net host -v /etc/localtime:/etc/localtime:ro \ 

-v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=:0 \ 

--security-opt Label=type:container_runtime_t \ 

--name test -ti fedora \ SF 


/bin/bash fe dora 
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Containerization inside 


@ Tools like podman (replacement for Docker + 
Kubernetes) and toolbox (simplified container 


management based on podman), both created by Red 
Hat, are fully compatible with Fedora 


@ Provide another security layer by isolating tools from 
the host OS 


@ Less resource hur ee 
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Containerization inside 


@ Tools like podman (replacement for Docker + 
Kubernetes) and toolbox (simplified container 
management based on podman), both created by Red 
Hat, are fully compatible with Fedora 


@ Provide another security layer by isolating tools from 
the host OS 


@lLess resource hungry than a virtual machines 


@ Access to network interfaces is available without a oP 
sole B network adapter 
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Docker, can be automatically updated directly by 
systemd 
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Containerization inside 


@ Podman has a better container integration than 
Docker, can be automatically updated directly by 
systemd 


@ Fedora Silverblue is fully modular, could be perfect 
in a VM for testing some stuff and for pentesting 
web apps 
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@ Modularity provides an extra-security layer from 
the host OS by sandboxing the software and its 
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So... Fedora is modular 


What is toolbox? 
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So... Fedora is modular 


What is toolbox? 


Let's see in a live demo 
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Oo... Fedora is modular 


Questions ? 
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Oo... Fedora is modular 


Thank you ! 


SOCIETE 
GENERALE 
Global Sclution'@antre Société Générale Global Solution Centre- Knowledge Sharing - april 


29th 2022 


